Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,406 npm 223,265 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,406 reports · Feed

  • npm
    cacheable-request 13.0.20
    MAL-2026-11964 ghsa-malware, amazon-inspector
  • PyPI
    psbt-helpers 1.0.0
    MAL-2026-11521 kam193 2 IOCs
  • PyPI
    launchdarkly-ai-server-sdk 1.0.1, 1.9.9
    MAL-2026-11519 kam193, amazon-inspector
  • PyPI
    psbt-utils 1.0.0
    MAL-2026-11520 kam193, amazon-inspector 2 IOCs
  • npm
    exnesss 0.0.1
    MAL-2026-11518 ossf-package-analysis, amazon-inspector, ghsa-malware
  • PyPI
    coldcard-helpers 1.4.2
    MAL-2026-11516 kam193, amazon-inspector
  • npm
    internallib_v688 1.0.3, 1.0.2, 1.0.1
    MAL-2026-11517 ghsa-malware, amazon-inspector
  • npm
    @zzzgenesis00/bip39-generator 3.1.2
    MAL-2026-11515 ossf-package-analysis, amazon-inspector
  • npm
    internallib_v524 1.0.2, 1.0.1
    MAL-2026-11512 ghsa-malware, amazon-inspector
  • PyPI
    instalogin1234 0.0.1
    MAL-2026-11503 kam193, amazon-inspector 1 IOC
  • npm
    simple-date-formatter-new-1 1.0.0
    MAL-2026-11502 ossf-package-analysis, amazon-inspector
  • npm
    internallib_v568 1.0.1
    MAL-2026-11513 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-items-with-more 12.2.6, 34.1.2
    MAL-2026-11509 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-header 12.3.9, 34.6.3
    MAL-2026-11508 ghsa-malware, amazon-inspector
  • npm
    bigops-chat-messages 19.9.8
    MAL-2026-11511 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-date-range-picker 34.5.9, 12.5.3
    MAL-2026-11506 ghsa-malware, amazon-inspector
  • npm
    accounts-final-form 9.9.9, 9.9.12, 9.9.11, 34.2.5, 12.5.5, 9.9.10, 0.0.1
    MAL-2026-11504 ghsa-malware, amazon-inspector
  • npm
    lifestyle-test-utils 20.7.2
    MAL-2026-11514 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-layout 12.9.6, 34.2.3
    MAL-2026-11510 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-grid 12.7.3, 34.6.4
    MAL-2026-11507 ghsa-malware, amazon-inspector
  • npm
    accounts-loading-state 12.5.7, 8.9.6, 34.7.7, 8.9.3, 8.9.5, 8.9.4, 0.0.1
    MAL-2026-11505 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util-5 1.0.0
    MAL-2026-11501 ossf-package-analysis, amazon-inspector
  • npm
    tailwind-anim 1.2.5, 1.1.0, 1.2.3, 1.2.4, 1.2.0, 1.0.0, 0.0.1, 1.1.1, 1.2.1
    MAL-2026-11500 ghsa-malware, amazon-inspector
  • npm
    list-issue-predecessor-dependencies-block 99.0.0
    MAL-2026-11430 ossf-package-analysis, amazon-inspector
  • npm
    tailwindcss-anim 1.3.3, 1.3.5, 1.1.1, 1.1.0, 1.0.0, 1.2.2, 1.2.1, 0.0.1
    MAL-2026-11487 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util-2 1.0.0
    MAL-2026-11485 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util 1.0.0
    MAL-2026-11483 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util-1 1.0.0
    MAL-2026-11484 ghsa-malware, ossf-package-analysis, amazon-inspector
  • PyPI
    trongriden 0.0.1
    MAL-2026-11429 kam193 4 IOCs
  • PyPI
    wacve-utils 1.0.7
    MAL-2026-11428 kam193, amazon-inspector 1 IOC
  • npm
    @custombots/custombot 1.0.0, 2.0.1, 2.0.2, 2.0.0
    MAL-2026-11498 ossf-package-analysis, amazon-inspector
  • npm
    pp-react-worldready 1.0.0
    MAL-2026-11427 ossf-package-analysis, amazon-inspector
  • PyPI
    nvtorch-oot-nightly 99999.0.0, 99999.0.1
    MAL-2026-11425 kam193, amazon-inspector
  • PyPI
    trtllm-subdir-test 99999.0.0, 99999.0.1
    MAL-2026-11426 kam193, amazon-inspector
  • npm
    test-dev-host 0.1.0
    MAL-2026-11491 ghsa-malware, amazon-inspector
  • npm
    test-dev-boot 0.1.0
    MAL-2026-11488 ghsa-malware, amazon-inspector
  • npm
    test-dev-watch 0.1.0
    MAL-2026-11495 ghsa-malware, amazon-inspector
  • npm
    test-dev-sync 0.1.0
    MAL-2026-11494 ghsa-malware, amazon-inspector
  • npm
    test-dev-store 0.1.0
    MAL-2026-11493 ghsa-malware, amazon-inspector
  • npm
    test-dev-link 0.1.0
    MAL-2026-11492 ghsa-malware, amazon-inspector